Overview: Multi-Factor Authentication (MFA) adds a second step to signing in, so if your password becomes compromised, it isn't enough to reach your account. Administrators can set it up on their own profile from the Buddy Punch website using an authenticator app, a passkey, or both.
Important! Multi-Factor Authentication is available on every Buddy Punch account. It is no longer limited to accounts using Buddy Punch Payroll.
Whether MFA is optional or required for you depends on the Multi-Factor Authentication policy set for your account under Account Settings. Accounts using Payroll always require it.
Instructions:
Set Up an Authenticator App
1. Start by clicking your profile icon in the top right corner, then My Profile:
2. Scroll to the Multi-Factor Authentication section and click Set up authenticator app:
3. Scan the QR code with an authenticator app on your phone — Google Authenticator, Microsoft Authenticator, Authy, and 1Password all work. If you can't scan it, enter the key printed beneath the code manually instead. Then enter the 6-digit code your app generates and click Verify:
4. Your recovery codes appear next. This is the only time they are shown, so click Download as .txt and keep the file somewhere safe. Then click Done:
Note: Each recovery code works once, and can be entered in place of an authenticator code if you don't have your phone. If you use them up or lose the file, you can create a fresh set from My Profile --> Regenerate recovery codes.
5. Back on My Profile, the Multi-Factor Authentication section now reads Authenticator app — Configured. From here you can remove the authenticator or regenerate your recovery codes at any time:
Add a Passkey
A passkey lets you complete the Multi-Factor Authentication step with your device's fingerprint, face, screen lock, or a hardware security key rather than typing a code.
Note: A passkey is a second factor, not a replacement for your password. You still sign in with your username and password first, then approve with the passkey.
1. From My Profile, in the Multi-Factor Authentication section, click Add a passkey:
2. Give the passkey a name if you'd like, so you can recognize which device it belongs to later, then click Create passkey:
3. Approve the prompt that your device shows — Touch ID, Face ID, Windows Hello, your screen lock, or a security key:
4. Once approved, the passkey is listed in the Multi-Factor Authentication section of your profile, where you can remove it later if you stop using that device:
Note: A passkey belongs to the device and browser you created it on, plus any device your iCloud Keychain or Google Password Manager syncs it to. If you sign in from more than one computer, add a passkey on each one or keep an authenticator app set up as a backup.
FAQs
Q: Do I need Multi-Factor Authentication if my company doesn't use Buddy Punch Payroll?
A: Multi-Factor Authentication is available to every Buddy Punch account, whether or not Payroll is in use. Whether it's optional or required for you depends on the policy set for your account under Account Settings. Accounts using Payroll require it regardless of that setting.
Q: Will I be asked for a code every time I log in?
A: If you tick Remember this browser? on the verification screen, that browser won't ask again for 14 days.
Q: What happens if I lose the phone with my authenticator app?
A: Enter one of your recovery codes in place of the authenticator code. If you've used them all or don't have the file, please reach out to our Support team for further assistance.
Q: I don't have a smartphone. What are my options?
A: Authenticator apps are also available as desktop apps and browser extensions, and a passkey can use your computer's fingerprint reader, face recognition, or screen lock, or a hardware security key.
Q: Can I use text message codes instead?
A: Text message codes still work for users who already had them set up, but they aren't offered for new setups. An authenticator app or a passkey is offered instead, as both are more resistant to phishing and SIM-swap attacks than SMS.
Q: Can I set up more than one method?
A: Yes. You can have an authenticator app and one or more passkeys on the same profile. When you log in, the verification screen lets you choose which one to use.